Undici Vulnerable To TLS Certificate Validation Bypass Via Dropped Tls Options In Agent

Impact undici's "Agent" passes its constructor options through a JSON-based deep clone "JSON.parseJSON.stringify..." before forwarding them to each per-origin "Pool". JSON cannot represent functions, so a caller-supplied "tls" option containing a "checkServerIdentity" callback is silently dropped...